The data protection and cyber security practice at Allens advises on the intersection of legal compliance, commercial focus and ethical grounding for clients from data-intensive businesses to large organisational bodies. Acting as both legal and policy advocates, the team has been working with the Australian Banking Association, advising on its submission to the Government following the Privacy Act Reform Review. Team co-head Valeska Bloch is particularly sought after for her expertise regarding highly regulated sectors, including the energy, resources, healthcare and financial services industries. Gavin Smith‘s data, security and law enforcement experience, combined with his dual qualification in England, bolsters the team’s GDPR experience. Melbourne-based Elyse Adams has notable expertise regarding payment technologies, including blockchain, and David Rountree is experienced across compliance, commercialisation, and cyber incident preparedness and response work.

Ashurst‘s ‘dynamic’ digital economy team is led by Brisbane-based Amanda Ludlow, an expert regarding data regulation. The team is engaged both in advising clients in regards to privacy reform and the development of digital regulation, and supporting them through cyber incidents and data breaches. Angela Summersby, based in Canberra, specialises in government-related work, with notable experience advising on data migration and program transformation projects. In Melbourne, Emma Butler is recommended for her work assisting with the development and implementation cyber strategies, with specific experience with energy sector clients. Sydney-based Tim Brookes and Geoff McGrath are also recommended.

The team at Corrs Chambers Westgarth is noted for its ‘excellent, deep and holistic subject matter expertise’, acting on a range of data and cyber matters for both public and private sector clients. Team head James North in Sydney has particular expertise advising on the data aspects of cross-border M&A transactions alongside a wider information security practice. Also in Sydney, Eugenia Kolivos ‘is an expert in this field‘, advising on privacy reforms, privacy policies and data protection in addition to cross-jurisdictional data protection and overseas data disclosure. Melbourne-based Philip Catania is praised as an 'absolute expert' and has a strong track record on large data breaches, both domestic and international, and bolsters the team’s international expertise providing advice for clients in regards to GDPR compliance. Arvind Dixit in Melbourne focuses on information technology work.

Sheila McGregor heads up the multidisciplinary, cross-practice digital and data team at Gilbert + Tobin from Sydney; the group's ‘deep subject matter expertise‘ covers all stages of the data lifecycle. Cyber resilience is an area of growing emphasis for the team, assisting clients with the implementation of cyber governance regimes and advising on best practice when responding to cyber incidents; Sydney-based Michael Williams has particular strength regarding cyber response strategy. Also in Sydney, Tim Gole advises businesses on privacy obligations with notable expertise regarding the highly regulated financial services and healthcare industries, while Melissa Fai specialises in data and privacy work including issues surrounding the commercialisation of data.

King & Wood Mallesons‘ digital economy and tech law team fields ‘thought leaders with extensive experience’, acting on matters from large public data breaches to risk mitigation. The team works with forensic IT investigators to manage the causes and impacts of cyber incidents for its clients, which include financial institutions, media companies and energy retailers. Cheng Lim and Patrick Gunning co-head the team from Melbourne and Sydney respectively; Lim is recommended for his ability to provide a ‘robust, holistic, commercial view‘, while Gunning is experienced in supporting high-profile clients through regulatory investigations and advising on changes to cybersecurity policy. Melbourne-based Michael Swinson ‘brings a wealth of knowledge and experience’ to mandates including data-heavy transactions and digital platform developments. Kirsten Bowe is a notable team member in Brisbane, specialising in strategic commercial transactions and advisory work involving emerging technologies, and Kendra Fouracre in Melbourne is also recommended.

Lauded for its ‘in-depth knowledge and experience in handling a wide range of matters‘, Baker McKenzie‘s data offering spans crisis management advice, compliance and regulatory work, and data-rich transactional mandates. Anne-Marie Allgrove and Adrian Lawrence lead the team, both in Sydney. Allgrove is recommended for her ‘ability to distil complex matters’ and is a leader in the firm’s global cybersecurity initiative; she has extensive experience regarding consumer data rights. Lawrence specialises in data-heavy commercial matters, and leads the firm’s global digital transformation initiative. In Sydney, Anne Petterd‘s practice focuses on navigating data issues for new product offerings, for clients ranging from start-ups to global companies.

The privacy and data protection team at Bird & Bird is ‘unique because it has excellent global reach and expertise’: working as part of an integrated global practice, it tracks international precedents to best support clients within Australia’s changing regulatory environment. The ‘very knowledgeable’ Sophie Dawson co-leads the team from Sydney, advising major companies on privacy law reform and providing strategic privacy advice. Also in Sydney, Hamish Fraser co-leads the team with notable experience in providing data breach advice to global platforms and cloud providers. Privacy compliance is an area of strength for Sydney partner Julie Cheeseman, who works with clients from a range of industries encompassing the media, technology, retail and consumer sectors, among others.

John Moran in Sydney, leads the cyber and digital practice at Clyde & Co LLP, which is praised as a team of ‘experienced lawyers with a deep understanding of privacy issues’. Moran specialises in advising corporates experiencing cyber crises, from cyber readiness advice to incident response planning and recovery work, including regulatory investigations. The team also advises on data frameworks and strategies for new and innovative projects, and has notable strength in multi-party data breaches. Working across Sydney and Auckland, Richard Berkahn advises clients across the APAC region.

Data sustainability is the focus for the team at DLA Piper, advising clients on strategic planning, reputation management issues and commercial opportunities as they relate to data. Tim Lyons leads the team, advising international clients on Australia privacy law from Melbourne, including those which regard the offshoring of personal information and compliance requirements. Cross-border data transfers are another area of expertise for the team. Also in Melbourne, special counsel Sarah Birkett advises clients from start-ups to international companies on Australian privacy law, including complex data storage and transfer arrangements.

Maddocks‘ cyber and data resilience team acts for clients ranging from international blue-chip companies to local government departments, providing advice on GDPR compliance, complex data breaches, social media issues and data transfer agreements. The team is co-led by Brendan Tomlinson and Sonia Sharma in Sydney, Katherine Armytage in Canberra, and Robert Gregory in Melbourne. Tomlinson primarily advises on IT transactions, while Sharma specialises in end-to-end data and privacy management issues and privacy governance. Armytage brings information law expertise to data protection issues, including advising on the application of privacy regulation for a number of public sector clients, and Gregory advises international government and corporate clients across the education, energy and financial services sectors.

Hall & Wilcox‘s cyber team advises on the whole life cycle of a cyber claim, from triaging incidents to managing forensic investigations and post-incident advisory services. The team is co-led by Eden Winokur and John Gray in Sydney, and Alison Baker in Melbourne. Baker has experience with both GDPR and the Privacy Act 1988 issues; Gray specialises in commercial transactions in the cyber field; and Winokur’s practice spans cyber, privacy, dispute and insurance matters, within Australia and internationally. Clients range from large commercial bodies to healthcare providers; the latter is a specialism of Sydney-based Alison Choy Flannigan.

The McCullough Robertson team ‘thrives because it “gets” tech and telecoms’, offering ‘smart and pragmatic advice’ to its clients, which range from state and local government entities to international corporates. Alex Hutchens leads the team from Sydney. Hutchens is ‘responsive, pragmatic, and great to work with’, while McMillan advises on a range of matters involving the protection and commercialisation of data, including the management of cyber risk issues. Since publication, the former joint practice head Matthew McMillan  departed.

Norton Rose Fulbright advises clients on compliance obligations, data transfers, and response strategies for adverse cyber incidents. Since publication, Anna Gamvros and Ross Phillipson departed to A&O Shearman.

Tim Clark and Andrea Beatty lead the privacy and data protection team at Piper Alderman, from Melbourne and Sydney respectively. With expertise in areas including spam legislation as it applies to marketing activities and workplace surveillance, the team represents clients within Australia and internationally, supported by overseas associates. Notably, it has particular experience assisting clients setting up overseas businesses with understanding foreign data laws, including EU GDPR and the UK’s Data Protection Act. Beatty acts for a range of financial services clients and Clark has extensive intellectual property protection experience.

Colin Biggers & Paisley‘s digital governance team is led by Katherine Jones in Sydney, and Morgan Lane in Melbourne, acting across data governance, privacy and risk management, enforcement, and recovery mandates. Jones brings large-scale litigation experience to cyber breach work, while Lane advises on data management and protection issues for a variety of clients ranging from established corporates to start-ups and individuals. The team supports clients to prepare business continuity, disaster recovery and cyber security plans, alongside data collection policies.

Melbourne-based Robyn Chatwood and Matthew Hennessy co-lead the data protection and cybersecurity offering at Dentons alongside Ben Allen in Sydney. The team offers a range of support from advice on regulatory issues to litigation services, partnering with the firm’s global and regional teams. Chatwood works with clients in the financial services, media and retail industries to mitigate the reputational risk of data breaches, while Hennessy and Allen advise both public and private sector clients on a range of cybersecurity issues, working closely with the white collar and government investigations team, which is also led by Allen.

KPMG Law in Australia‘s cyber, privacy and digital data law team is praised for its ‘wide range of expertise‘, supporting a range of private and public sector clients in developing incident response plans, managing policy reform and ensuring regulatory compliance. Veronica Scott leads the team from Melbourne, bringing experience in privacy, information security, and data ethics to clients across a range of industry sectors including the education, healthcare, mining and technology industries.

Kieran Doyle heads up the cyber, privacy and data security team at Wotton + Kearney from Sydney; he is ‘a leading cyber coverage lawyer’ who works across multiple jurisdictions on a range of cyber incident response matters. The team has a dedicated cyber incident hotline and particular experience using AI tools to support clients. Alongside incident response work, the team provides privacy advice, including in regards to regulatory investigations.